Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer ("Customer") and Tanzeel Labs LLC ("Processor"). It applies where the Processor processes personal data on the Customer's behalf.
1. Roles and scope
1.1 For personal data in Customer content, the Customer is the controller and the Processor is the processor (GDPR Art. 28; UK GDPR Art. 28; equivalent provisions of other applicable laws).
1.2 Annex 1 describes the processing.
2. Instructions
2.1 The Processor processes personal data only on the Customer's documented instructions, which are these terms and the Customer's use of the Service, unless the law requires otherwise.
2.2 If the law requires other processing, the Processor will tell the Customer first, unless the law forbids that. The Processor will tell the Customer if it believes an instruction breaches data‑protection law.
3. Confidentiality
Everyone authorised to process the personal data is bound by confidentiality.
4. Security
The Processor implements the technical and organisational measures in Annex 2. They may be updated, provided the overall level of protection is not reduced.
5. Sub‑processors
5.1 The Customer gives general authorisation for the sub‑processors listed in Annex 3.
5.2 The Processor will give at least 15 days' notice of any new or replacement sub‑processor. The Customer may object on reasonable data‑protection grounds. If the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a credit for unused prepaid credits.
5.3 The Processor imposes data‑protection obligations on each sub‑processor that are no less protective than this DPA, and remains responsible for their performance.
6. Assistance
Taking into account the nature of the processing, the Processor will assist the Customer:
- in responding to data‑subject requests, including through the export and deletion tools in the Service;
- with security, breach notification, data‑protection impact assessments and prior consultation.
7. Personal‑data breaches
The Processor will notify the Customer without undue delay, and in any event within 48 hours of becoming aware of a personal‑data breach affecting Customer data. The notice will include the information then available, and the Processor will provide further information as it becomes available.
8. Deletion and return
At the end of the Service, the Customer may export its data for 30 days. The Processor then deletes it, including from backups as they expire, unless the law requires storage.
9. Audits
9.1 The Processor will make available the information needed to show compliance with this DPA. This includes this document, its security summary and, when obtained, independent certifications.
9.2 The Customer may carry out an audit, or have one carried out, once a year on 30 days' notice, at its own cost, subject to confidentiality.
10. International transfers
Where personal data is transferred to a country without an adequacy decision, the parties rely on the EU Standard Contractual Clauses (Module 2 or 3 as applicable) and, for UK data, the UK International Data Transfer Addendum, which are incorporated by reference.
11. Precedence
If this DPA conflicts with the Terms of Service on data protection, this DPA prevails.
12. Term and survival
This DPA runs for the duration of the Terms of Service. Sections 7 (breach notification), 8 (deletion and return) and 9 (audits) survive termination.
Annex 1 — Description of processing
| Item | Description |
|---|---|
| Subject matter | Providing AI‑assisted contract drafting, review, revision, signing and key‑date tracking |
| Duration | The term of the Customer's account, plus the deletion period in section 8 |
| Nature and purpose | Storage, AI processing, display, export, electronic signing and email notifications |
| Data subjects | Customer's users; counterparties, signatories and other people named in Customer documents |
| Categories of data | Names, contact details, job titles, company details, signatures and signing metadata, and any other personal data the Customer includes in documents |
| Special categories | Not intended. The Customer should not include them unless necessary and lawful |
Annex 2 — Security measures
- Encryption in transit (TLS).
- Access control: each customer sees only its own data; staff access is limited to need and logged. Authentication uses secure password hashing (bcrypt) with rate-limited login.
- Lawyer reviewers see only matters the customer assigns, with access logged.
- Backups where the hosting provider supports them; backup frequency and encryption depend on the hosting tier.
- Secure development: dependency and code scanning, security headers (Helmet with strict CSP), input validation (Zod), parameterised SQL queries and rate limits.
- Logging and alerting for security events via the audit log.
- A breach‑response plan and a breach register.
- Confidentiality obligations for all personnel with access to customer data.
Annex 3 — Approved sub‑processors
| Sub‑processor | Service | Location |
|---|---|---|
| Render Services, Inc. | Hosting and database | Frankfurt, Germany |
| Anthropic, PBC | AI processing | United States |
| Stripe | Payment processing | EU / United States |
| Resend | Transactional email | United States |
Last updated 27 October 2026.